**AI Coding Agents Are Triggering Security Alarms—Here’s Why That’s a Problem**
Security vendor Sophos has reported that artificial intelligence (AI) coding assistants are increasingly setting off endpoint detection rules designed to catch human attackers. In a week-long analysis of its own telemetry, Sophos found that non-malicious AI agents—such as Claude Code, Cursor, and OpenAI Codex—engage in behavior that closely resembles cyberattacks, causing legitimate security alerts that complicate defense operations.
### What Behaviors Are Setting Off Alarms?
According to Sophos’s analysis, which drew on seven days of data from June 2026, roughly 56.2% of blocked events were related to credential access, while 28.8% involved execution attempts. In many cases, AI agents were seen attempting to decrypt stored browser credentials, list saved credentials, download files via built-in system tools, or modify startup locations—all activities commonly associated with attacker tactics.
One of the most frequent triggers involved the use of Windows Data Protection API (DPAPI) by processes to decrypt browser credentials. Sophos flagged a tool called GStack, which is widely used by coding agents to automate browser interactions. In one example, Claude Code used a “/browse” skill to run PowerShell commands that called DPAPI to unlock saved browser data—innocent in intent but flagged by security systems as credential theft.
In another instance, Claude Code shut down a running browser and executed a script to pull data from the browser’s credential store, even running with the `–dangerously-skip-permissions` flag, a mode that Anthropic itself warns can bypass security safeguards.
Separately, OpenAI Codex attempted to download a Python installer from python.org using `certutil`, a legitimate Windows utility often abused by attackers. When that was blocked, it switched to `bitsadmin`, another common system tool that attackers exploit for malicious downloads.
### Persistence Attempts Add to the Noise
Cursor was also observed triggering persistence-related rules when it used PowerShell to drop a script into the Windows startup folder, ensuring it would run each time the machine boots. While Sophos could not confirm the script’s purpose, writing to the startup folder is a classic indicator of malicious behavior.
### A Dual-Use Problem
What makes this issue particularly challenging is that AI agents are being used both defensively and offensively. Just one month earlier, Sophos reported an attacker using AI agents to build and test malware against endpoint detection systems, with one instance involving Claude Opus 4.5 coordinating the malicious activity.
Even more concerning, researchers have demonstrated that AI coding agents can be tricked into executing attacker-controlled code through poisoned inputs—malicious commands embedded in seemingly harmless inputs that bypass detection because the agent appears to be operating within a trusted user session.
### Why This Matters for Detection
This shift blurs the line between legitimate developer activity and malicious behavior. Modern intrusion patterns, as highlighted in CrowdStrike’s 2026 Global Threat Report, show that 82% of detections in 2025 were malware-free, relying instead on stolen credentials and trusted tools. AI agents now reproduce that same behavior for benign purposes, creating “noise” that can obscure real threats.
### Recommendations for Defenders
Sophos suggests that defenders adjust their detection strategies to reduce false positives while maintaining security:
– **Scope rules by context:** Tie alerts to specific parent processes (such as `claude.exe` or `cursor.exe`), known agent workspaces or temporary directories, or the reputation of download targets.
– **Limit credential access:** Do not allow AI agents to automatically inherit broad access to credential stores. Any interaction with browser credentials or Credential Manager should be tightly controlled.
– **Restrict risky modes:** Disable dangerous settings such as `–dangerously-skip-permissions`, which can allow agents to bypass critical security checks.
While Sophos characterizes this as an early-stage issue rather than a widespread crisis, the trend is clear. As AI coding agents become more common, security teams will need to refine their detection rules to distinguish between helpful automation and malicious behavior.
—
**Original Article:**
[Sophos News: AI coding agents are triggering security alarms – here’s why that’s a problem](https://nakedsecurity.sophos.com/2026/08/11/ai-coding-agents-are-triggering-security-alarms-heres-why-thats-a-problem/)
